| Commit message (Collapse) | Author | Age | Files | Lines | ||
|---|---|---|---|---|---|---|
| ... | ||||||
| * | fix: don't make IBPB mandatory when it's not there | Stéphane Lesimple | 2018-01-24 | 1 | -0/+4 | |
| | | | | | | | On some kernels there could be IBRS support but not IBPB support, in that case, don't report VULN just because IBPB is not enabled when IBRS is | |||||
| * | fix(cosmetic): tiny msg fixes | Stéphane Lesimple | 2018-01-24 | 1 | -4/+5 | |
| | | ||||||
| * | fix(cpu): trust is_cpu_vulnerable even w/ debugfs | Stéphane Lesimple | 2018-01-24 | 1 | -9/+6 | |
| | | | | | | | For variant3 under AMD, the debugfs vulnerabilities hierarchy flags the system as Vulnerable, which is wrong. Trust our own is_cpu_vulnerable() func in that case | |||||
| * | fix(variant3): do our checks even if sysfs is here | Stéphane Lesimple | 2018-01-24 | 1 | -1/+2 | |
| | | ||||||
| * | fix(retpoline): retpoline-compiler detection | Stéphane Lesimple | 2018-01-24 | 1 | -5/+5 | |
| | | | | | | | | | | When kernel is not compiled with retpoline option, doesn't have the sysfs vulnerability hierarchy and our heuristic to detect a retpoline-aware compiler didn't match, change result for retpoline-aware compiler detection from UNKNOWN to NO. When CONFIG_RETPOLINE is not set, a retpoline-aware compiler won't produce different asm than a standard one anyway. | |||||
| * | feat(retpoline): check if retpoline is enabled | Stéphane Lesimple | 2018-01-24 | 1 | -0/+14 | |
| | | | | | | | Before we would just check if retpoline was compiled in, now we also check that it's enabled at runtime (only in live mode) | |||||
| * | feat(sysfs): print details even with sysfs | Stéphane Lesimple | 2018-01-24 | 1 | -18/+53 | |
| | | | | | | | | | | | Before, when the /sys kernel vulnerability interface was available, we would bypass all our tests and just print the output of the vulnerability interface. Now, we still rely on it when available, but we run our checks anyway, except for variant 1 where the current method of mitigation detection doesn't add much value to the bare /sys check | |||||
| * | feat(ibpb): now also check for IBPB on variant 2 | Stéphane Lesimple | 2018-01-24 | 1 | -41/+124 | |
| | | | | | | | | | | | In addition to IBRS (and microcode support), IBPB must be used to mitigate variant 2, if retpoline support is not available. The vulnerability status of a system will be defined as "non vulnerable" if IBRS and IBPB are both enabled, or if IBPB is enabled with a value of 2 for RedHat kernels, see https://access.redhat.com/articles/3311301 | |||||
| * | fix(offline): report unknown when too few info | Stéphane Lesimple | 2018-01-23 | 1 | -3/+15 | |
| | | | | | | | | | In offline mode, in the worst case where an invalid config file is given, and we have no vmlinux image nor System.map, the script was reporting Variant 2 and Variant 3 as vulnerable in the global status. Replace this by a proper pair of UNKNOWNs | |||||
| * | feat: detect invalid kconfig files | Stéphane Lesimple | 2018-01-23 | 1 | -3/+11 | |
| | | ||||||
| * | fix(dmesg): detect when dmesg is truncated | Stéphane Lesimple | 2018-01-21 | 1 | -20/+34 | |
| | | | | | | | | | | | | To avoid false negatives when looking for a message in dmesg, we were previously also grepping in known on-disk archives of dmesg (dmesg.log, kern.log). This in turn caused false positives because we have no guarantee that we're grepping the dmesg of the current running kernel. Hence we now only look in the live `dmesg`, detect if it has been truncated, and report it to the user. | |||||
| * | fix(cpu): Pentium Exxxx series are not vulnerable | Stéphane Lesimple | 2018-01-21 | 1 | -1/+6 | |
| | | | | | | | Pentium E series are not in the vulnerable list from Intel, and Spectre2 PoC reportedly doesn't work on an E5200 | |||||
| * | fix(display): use text-mode compatible colors | Stéphane Lesimple | 2018-01-21 | 1 | -4/+4 | |
| | | | | | | | | in text-mode 80-cols TERM=linux terminals, colors were not displaying properly, one had to use --no-color to be able to read some parts of the text. | |||||
| * | bump to v0.32 | Stéphane Lesimple | 2018-01-20 | 1 | -1/+1 | |
| | | ||||||
| * | revert to a simpler check_vmlinux() | Stéphane Lesimple | 2018-01-20 | 1 | -11/+1 | |
| | | ||||||
| * | cache is_cpu_vulnerable result for performance | Stéphane Lesimple | 2018-01-20 | 1 | -6/+18 | |
| | | ||||||
| * | is_cpu_vulnerable: implement check for multi-arm systems | Stéphane Lesimple | 2018-01-20 | 1 | -33/+64 | |
| | | ||||||
| * | check_vmlinux: when readelf doesn't work, try harder with another way | Stéphane Lesimple | 2018-01-20 | 1 | -2/+12 | |
| | | ||||||
| * | be smarter to find a usable echo command | Stéphane Lesimple | 2018-01-20 | 1 | -3/+17 | |
| | | ||||||
| * | add pine64 vmlinuz location | Stéphane Lesimple | 2018-01-20 | 1 | -0/+7 | |
| | | ||||||
| * | arm: cosmetic fix for name and handle aarch64 | Stéphane Lesimple | 2018-01-20 | 1 | -2/+4 | |
| | | ||||||
| * | ARM: display a friendly name instead of empty string | Stéphane Lesimple | 2018-01-20 | 1 | -1/+6 | |
| | | ||||||
| * | search in /lib/modules/$(uname -r) for vmlinuz, config, System.map | Harald Hoyer | 2018-01-20 | 1 | -0/+5 | |
| | | | | | On Fedora machines /lib/modules/$(uname -r) has all the files. | |||||
| * | Atom N270: implement another variation | Stéphane Lesimple | 2018-01-19 | 1 | -1/+2 | |
| | | ||||||
| * | CoreOS: remove ephemeral install of a non-used package | Stéphane Lesimple | 2018-01-18 | 1 | -1/+1 | |
| | | ||||||
| * | add kern.log as another backend of dmesg output | Stéphane Lesimple | 2018-01-17 | 1 | -0/+7 | |
| | | ||||||
| * | fix(atom): don't use a pcre regex, only an extended one | Stéphane Lesimple | 2018-01-17 | 1 | -1/+1 | |
| | | ||||||
| * | fix(atom): properly detect Nxxx Atom series | Stéphane Lesimple | 2018-01-17 | 1 | -1/+3 | |
| | | ||||||
| * | Add Support for Slackware. | Willy Sudiarto Raharjo | 2018-01-16 | 1 | -0/+1 | |
| | | | | | Signed-off-by: Willy Sudiarto Raharjo <willysr@gmail.com> | |||||
| * | Implement CoreOS compatibility mode (#84) | Stéphane Lesimple | 2018-01-16 | 1 | -26/+95 | |
| | | | | | | | | * Add special CoreOS compatibility mode * CoreOS: refuse --coreos if we're not under CoreOS * CoreOS: warn if launched without --coreos option * is_coreos: make stderr silent * CoreOS: tiny adjustments | |||||
| * | bump to v0.31 to reflect changes | Stéphane Lesimple | 2018-01-14 | 1 | -1/+1 | |
| | | ||||||
| * | meltdown: detecting Xen PV, reporting as not vulnerable | Stéphane Lesimple | 2018-01-14 | 1 | -1/+22 | |
| | | ||||||
| * | is_cpu_vulnerable: add check for old Atoms | Stéphane Lesimple | 2018-01-14 | 1 | -1/+10 | |
| | | ||||||
| * | verbose: add PCID check for performance impact of PTI | Stéphane Lesimple | 2018-01-14 | 1 | -2/+24 | |
| | | ||||||
| * | Merge pull request #80 from speed47/cpuid_spec_ctrl | Stéphane Lesimple | 2018-01-14 | 1 | -3/+64 | |
| |\ | | | | | v0.30, cpuid spec ctrl and other enhancements | |||||
| | * | bump to v0.30 to reflect changes | Stéphane Lesimple | 2018-01-14 | 1 | -1/+1 | |
| | | | ||||||
| | * | ibrs: check for spec_ctrl_ibrs in cpuinfo | Stéphane Lesimple | 2018-01-14 | 1 | -3/+19 | |
| | | | ||||||
| | * | also check for spec_ctrl flag in cpuinfo | Stéphane Lesimple | 2018-01-14 | 1 | -7/+15 | |
| | | | ||||||
| | * | also check for cpuinfo flag | Stéphane Lesimple | 2018-01-14 | 1 | -8/+8 | |
| | | | ||||||
| | * | check spec_ctrl support using cpuid | Stéphane Lesimple | 2018-01-14 | 1 | -3/+40 | |
| | | | ||||||
| * | | Merge pull request #79 from andir/add-nixos | Stéphane Lesimple | 2018-01-14 | 1 | -0/+1 | |
| |\ \ | |/ |/| | add support for NixOS kernel | |||||
| | * | add support for NixOS kernel | Andreas Rammhold | 2018-01-14 | 1 | -0/+1 | |
| |/ | | | | this removes the need to specify the kernel version manually on NixOS | |||||
| * | fix: proper detail msg in vuln status | Stéphane Lesimple | 2018-01-14 | 1 | -1/+3 | |
| | | ||||||
| * | Merge pull request #77 from speed47/exitcode | Stéphane Lesimple | 2018-01-14 | 1 | -47/+50 | |
| |\ | | | | | proper return codes regardless of the batch mode | |||||
| | * | proper return codes regardless of the batch mode | Stéphane Lesimple | 2018-01-14 | 1 | -47/+50 | |
| |/ | ||||||
| * | add info about accuracy when missing kernel files | Stéphane Lesimple | 2018-01-13 | 1 | -0/+8 | |
| | | ||||||
| * | AMD now vuln to variant2 (as per their stmt) | Stéphane Lesimple | 2018-01-13 | 1 | -2/+5 | |
| | | ||||||
| * | minor is_cpu_vulnerable() changes (#71) | Corey Hickey | 2018-01-13 | 1 | -10/+7 | |
| | | | | | | | | | | | | | | | | | | | | | * correct is_cpu_vulnerable() comment As far as I can tell, the function and usage are correct for the comment to be inverted. Add a clarifying note as to why the value choice makes sense. * exit on invalid varient If this happens, it's a bug in the script. None of the calling code checks for status 255, so don't let a scripting bug cause a false negative. * no need to set vulnerable CPUs According to comment above this code: 'by default, everything is vulnerable, we work in a "whitelist" logic here.' | |||||
| * | Only show the name of the script, not the full path (#72) | Sylvestre Ledru | 2018-01-13 | 1 | -2/+2 | |
| | | ||||||
| * | fix some typos (#73) | Sylvestre Ledru | 2018-01-13 | 1 | -2/+2 | |
| | | ||||||
 |
index : spectre-meltdown-checker.git | |
| Spectre, Meltdown, Foreshadow, Fallout, RIDL, ZombieLoad vulnerability-mitigation checker for GNU+Linux or BSD | heckyel |
| aboutsummaryrefslogtreecommitdiffstats |